Microsoft Targets Code Hijacking With Release of EMET 5.2

Microsoft has released version 5.2 of its Enhanced Mitigation Experience Toolkit (EMET), which offers increased security protections in several areas, including code hijacking attacks and improvements in Attack Surface Reduction (ASR) mitigation.

For those unfamiliar with the tool, as Microsoft explains it, EMET “anticipates the most common actions and techniques adversaries might use” in compromising a computer, and helps protect systems against new and undiscovered threats and exploits by diverting, terminating, blocking, and invalidating those actions and techniques.

According to Microsoft, EMET 5.2’s native DLLs have been compiled with Control Flow Guard (CFG), a new feature introduced in Visual Studio 2015 that helps detect and stop attempts of code hijacking. EMET native DLLs (i.e. EMET.DLL) are injected into the application process EMET protects, Microsoft said.

Because Microsoft strongly encourages 3rd party developers to recompile their application to take advantage of the latest security technology, EMET has been compiled with CFG. More information on CFG is available in a blog post from the this Visual C++ Team. 

Additionally, the configuration for the ASR mitigation in EMET 5.2 has been improved to stop attempts to run the VBScript extension when loaded in the Internet Explorer’s Internet Zone. This would mitigate the exploitation technique known as “VBScript God Mode” observed in recent attacks, Microsoft explained.

Finally, EMET 5.2 fully supports alerting and reporting from Modern Internet Explorer, or Desktop IE with Enhanced Protected Mode enabled.

While EMET does add an extra layer of security against various attacks, the toolkit has been bypassed or disarmed on several occasions by researchers in the past.

In late September 2014, researchers at presented a method that can be used to disarm EMET 5.0. Not long after, in Nov. 2014, researcher René Freingruber found “numerous methods to get around the basic protection mechanisms of EMET.”

Additionally, while the tool is stable overall, users should be cautious when using it, as Microsoft has warned that some security mitigation technologies may break applications. The software giant strongly suggests thoroughly testing EMET in all target use scenarios before rolling it out to a production environment.

“There is no one tool capable of preventing all attacks. EMET is designed to make it more difficult, expensive and time consuming, and therefore less likely, for attackers to exploit a system,” a Microsoft spokesperson previously told SecurityWeek.

EMET 5.2 can be downloaded from microsoft.com/emet.